Splunk Search

How do I combine multiple lookups into one lookup?

Glasses
Builder

Lets say I have 3 lookups >>> a-list.csv, b-list.csv, c-list.csv and the lists only have 1 column header = Name
Alice is on a-list
Bob is on b-list
Charles is on c-list

There are lots of people on each list and the lists are dynamic and updated.
I have a request to create a Combined_Master Lookup (where C_M-list.csv = a-list.csv + b-list.csv + c-list.csv),
where the list contains NAME, FLAG fields such as

NAME,FLAG

Alice, a-list
Bob, b-list
Charles, c-list

So far I use the following query to build the C_M-list.csv, where there is a Name and Flag appended to each name (which indicate which list the person is from)
BUT I am wondering if there is a better way...

 

| inputlookup a-list.csv 
| eval FLAG = "a-list"
| inputlookup b-list.csv append=true
| eval FLAG = coalesce(FLAG, "b-list") 
| inputlookup c-list.csv append=true
| eval FLAG = coalesce(FLAG, "c-list")
|.... <rest of the query follows>....

 

My desired outcome is a M_C-list.csv

Alice,a-list

Bob,b-list

Charles,c-list

Any suggestions or improvements appreciated.
TY!

Labels (1)
1 Solution

jacobpevans
Motivator

Greetings @Glasses,

Try this:

           | inputlookup a-list.csv 
           | eval FLAG = "a-list"

| append [ | inputlookup b-list.csv
           | eval FLAG = "b-list" ]

| append [ | inputlookup c-list.csv
           | eval FLAG = "c-list" ]
Cheers,
Jacob

If you feel this response answered your question, please do not forget to mark it as such. If it did not, but you do have the answer, feel free to answer your own post and accept that as the answer.

View solution in original post

0 Karma

jacobpevans
Motivator

Greetings @Glasses,

Try this:

           | inputlookup a-list.csv 
           | eval FLAG = "a-list"

| append [ | inputlookup b-list.csv
           | eval FLAG = "b-list" ]

| append [ | inputlookup c-list.csv
           | eval FLAG = "c-list" ]
Cheers,
Jacob

If you feel this response answered your question, please do not forget to mark it as such. If it did not, but you do have the answer, feel free to answer your own post and accept that as the answer.
0 Karma

Glasses
Builder

@jacobpevans NICE!!!

I tried something similar with subsearches and failed... but this seems like they way to go.

Thank you!

0 Karma

Glasses
Builder

Is there a way to use "foreach" to add the flag and append?

0 Karma
Got questions? Get answers!

Join the Splunk Community Slack to learn, troubleshoot, and make connections with fellow Splunk practitioners in real time!

Meet up IRL or virtually!

Join Splunk User Groups to connect and learn in-person by region or remotely by topic or industry.

Get Updates on the Splunk Community!

Announcing Modern Navigation: A New Era of Splunk User Experience

We are excited to introduce the Modern Navigation feature in the Splunk Platform, available to both cloud and ...

Modernize your Splunk Apps – Introducing Python 3.13 in Splunk

We are excited to announce that the upcoming releases of Splunk Enterprise 10.2.x and Splunk Cloud Platform ...

Step into “Hunt the Insider: An Splunk ES Premier Mystery” to catch a cybercriminal ...

After a whole week of being on call, you fell asleep on your keyboard, and you hit a sequence of buttons that ...